CVE-2005-1682

LOW 2.1CVE-2005-1682 · Published 20/05/2005 · updated 16/06/2026

In short

CVE-2005-1682 is a LOW (CVSS 2.1) vulnerability affecting solstice internet mail server (solstice).
Chance of exploitation in the next 30 days (EPSS): 0.69%, higher than 52.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
solstice internet mail server solstice	`= pop3_2.0`	No fix yet

Description

JavaMail API, as used by Solstice Internet Mail Server POP3 2.0, does not properly validate the message number in the MimeMessage constructor in javax.mail.internet.InternetHeaders, which allows remote authenticated users to read other users' e-mail messages by modifying the msgno parameter. NOTE: Sun disputes this issue, stating "The report makes references to source code and files that do not exist in the mentioned products.

References

marc.info
vupen.com/english/advisories/2005/0574 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free